agent-bom v0.93.0

What's Changed

• fix(docs): keep extension contract link mkdocs-strict safe by @msaad00 in #3429
• docs(readme): refresh personas and terminal demo for 0.92.0 CLI by @msaad00 in #3430
• fix(ci): unblock Sigma WebGL E2E dynamic import by @msaad00 in #3432
• chore(perf): findings read bench and 2k CI regression by @msaad00 in #3440
• feat(retention): enforce graph snapshot purge and history cap (PR1) by @msaad00 in #3441
• feat(api): server-side compliance hub findings pagination (PR1) by @msaad00 in #3442
• fix(scan): skip unreachable Go checksum lookups by @msaad00 in #3443
• fix(compliance): normalize pci-dss slug alias and SAML install hint (#3439) by @msaad00 in #3444
• feat(helm): Alembic pre-upgrade hook; chore(sdks): bump Python SDK (#3433, #3438) by @msaad00 in #3445
• fix(scan): reduce secret FP on OAuth token minting assignments (#3437) by @msaad00 in #3447
• refactor(output): migrate compact and console formatters to Finding (#2918) by @msaad00 in #3448
• feat(skills): CI exit code and wider skill file discovery (#3434) by @msaad00 in #3449
• fix(hardening): Role enum, Grafana creds, ecosystem claims, HOSTS rollup (#3242) by @msaad00 in #3450
• feat(release): SBOM release asset, image scan gate, air-gap vuln-DB docs (#3436) by @msaad00 in #3451
• fix(hardening): severity unification and cosign/MCP audit fixes (#3242) by @msaad00 in #3452
• feat(retention): per-tenant graph retention and analytics cap (PR2) by @msaad00 in #3453
• feat(api): findings read PR2 — approximate counts and UI pagination (#3192) by @msaad00 in #3454
• chore(deps): combine dependency updates (2026-07-03) by @andres-linero in #3460
• feat(api): expression-indexed severity/cvss finding sorts (#3192) by @msaad00 in #3461
• fix(api): idempotent finding ingest (P0) (#3242) by @msaad00 in #3462
• fix(reliability): tenant fail-closed, cloud retry, health rate-exempt, batch cap by @msaad00 in #3464
• feat(enrich): bundle KEV and EPSS into offline vuln-DB layer by @msaad00 in #3466
• feat(ui): labeled demo estate and surface lock states (PR1) by @msaad00 in #3467
• feat(api): finding lifecycle L1 — monotone current-state merge (#3465) by @msaad00 in #3470
• fix(api): batch cap returns 422 and index filtered severity+cvss reads (#3474) by @msaad00 in #3477
• chore(repo): hygiene + session cookie Secure default (#3475) by @msaad00 in #3479
• fix(auth): cluster-safe SAML RelayState nonce store (#3476) by @msaad00 in #3478
• feat(api): finding lifecycle L2 — occurrence log keyed on scan_id (#3465) by @msaad00 in #3480
• feat(sdk): expose finding lifecycle ingest on control-plane clients by @msaad00 in #3483
• feat(api): finding lifecycle L3+L4 — resolve reconcile and current-state reads (#3465) by @msaad00 in #3481
• docs(audit): add sanitized 2026-07-03 ledger with issue mapping by @msaad00 in #3500
• fix(api): harden OCSF ingest — cap/offload (A) + deterministic event IDs & ClickHouse dedup (J) by @msaad00 in #3501
• feat(ui): interactive blast-radius overlay on the lineage graph by @msaad00 in #3502
• fix(ui): dock graph lens switcher — stop overlaying the canvas by @msaad00 in #3505
• docs(deploy): auto-migration hook, finding encryption prereq, ClickHouse OSS+Cloud by @msaad00 in #3504
• feat(ui): wire estate roll-up navigation for large graphs by @msaad00 in #3507
• fix(api,http): bound ScanRequest list elements and jitter sync retries by @msaad00 in #3508
• fix(api): gate external compliance frameworks and lock OCSF product attribution by @msaad00 in #3509
• fix(api): restore overview tiles from compact scans and add current-state sort indexes by @msaad00 in #3515
• refactor(api): deduplicate current-state hub payloads via ledger refs by @msaad00 in #3517
• feat(api): keyset cursor pagination for hub current-state findings by @msaad00 in #3518
• perf(api): gzip JSON responses and zstd-compress hub payloads at rest by @msaad00 in #3516
• feat(helm): enterprise-demo profile with AWS estate inventory cron by @msaad00 in #3519
• feat(api,ui): overview graph drill and estate correlation API by @msaad00 in #3520
• fix(cloud,helm): http_client GPU connectors + scoped API NetworkPolicy by @msaad00 in #3522
• feat(scanners): runtime-enforce driver run() and failure_mode by @msaad00 in #3524
• fix(api): Postgres rate-limit sliding window matches docstring by @msaad00 in #3523
• docs: compact session/enforcement flow diagrams by @andres-linero in #3525
• feat(api): async findings report export jobs by @msaad00 in #3526
• perf(analytics): ClickHouse sink dedup for canonical rows by @msaad00 in #3527
• fix(api): CVSS keyset pagination and report export truncation by @msaad00 in #3530
• refactor(api): hub reference-table normalization by @msaad00 in #3528
• docs(deploy): audit Alembic, encryption prerequisite, ClickHouse positioning by @msaad00 in #3532
• fix(api/scim): group PATCH, deprovision keys, SCIM error envelopes by @msaad00 in #3540
• feat(export): delta-stream connector for SIEM and data-lake sinks by @msaad00 in #3531
• test(api): lock in hub current-state payload dedup by @msaad00 in #3541
• feat(api): S3 report export artifacts with presigned URLs by @msaad00 in #3542
• fix(api/scim): PUT full replace and schema discovery by id by @msaad00 in #3543
• fix(api): gate bulk-ingest O(n) snapshot walk (#3544) by @msaad00 in #3545
• fix(fleet): local discovery push for fleet sync by @msaad00 in #3546
• chore(glama): pin release ref and verify Dockerfile on publish by @msaad00 in #3547
• docs(audit): sync AUDIT-2026-07-03 ledger with shipped main by @msaad00 in #3550
• docs(readme): lead with personas, Start Here, and demo proof by @msaad00 in #3548
• feat(headless): wire findings push CLI and hub current-state list (#3482) by @msaad00 in #3549
• feat(ui): show findings lifecycle status and timestamps in queue by @msaad00 in #3551
• fix(cli): skip PyPI update check in offline and air-gap mode (#3242) by @msaad00 in #3552
• fix(deploy): mount ~/.agent-bom for abom user in compose profiles (#3242) by @msaad00 in #3553
• fix(cli): reject reserved tenant ids on CLI and MCP resolvers (#3242) by @msaad00 in #3554
• docs(audit): headless ingest docs and audit ledger sync by @msaad00 in #3555
• fix(cli): honor --offline for PyPI check and loopback fleet push by @msaad00 in #3556
• fix(headless): offline push, MCP check version, token-derived auth by @msaad00 in #3557
• chore(ci): reject LLM co-author trailers in commit messages by @msaad00 in #3558
• refactor(output): use canonical severity_rank in remediation plan by @msaad00 in #3559
• docs(audit): sync ledger for headless hardening #3556-#3558 by @msaad00 in #3560
• fix(auth): reject replayed OIDC JWTs via jti one-time store by @msaad00 in #3561
• refactor(trust): derive CVE weights from canonical severity_rank by @msaad00 in #3562
• docs(audit): sync ledger post #3561 OIDC jti replay by @msaad00 in #3563
• feat(plugins): runtime activation for opt-in plugin entry points by @andres-linero in #3564
• refactor(severity): unify API scan and compact CIS sort ranks by @msaad00 in #3565
• refactor(severity): canonical CIS sort ranks in HTML report by @msaad00 in #3566
• refactor(severity): canonical package severity rank in Mermaid output by @msaad00 in #3567
• refactor(severity): canonical CIS sort ranks in console renderer by @msaad00 in #3568
• refactor(severity): canonical sort ranks in skills, license, extensions by @msaad00 in #3569
• feat(reachability): export Python symbol reachability in findings by @msaad00 in #3571
• refactor(output): migrate markdown CVE sections to unified Finding by @msaad00 in #3570
• perf(db): partition hub observations with retention rollover by @msaad00 in #3572
• feat(reachability): include symbol reachability in delta-stream snapshots by @msaad00 in #3573
• refactor(output): migrate PDF CVE sections to unified Finding by @msaad00 in #3574
• feat(reachability): multilang symbol join + CWE/CVE/CPE advisory context by @msaad00 in #3576
• feat(reachability): wire symbol reach into triage scoring and VEX by @msaad00 in #3577
• refactor(output): migrate SARIF CVE loop to unified Finding stream by @msaad00 in #3578
• feat(reachability): Java/Rust AST symbol join for Maven and Cargo by @msaad00 in #3579
• docs(readme): product-first flow, compact persona band, plain-language taglines by @msaad00 in #3580
• feat(reachability): NuGet/C# AST symbol join for .NET MCP backends by @msaad00 in #3581
• feat(reachability): RubyGems AST symbol join for Rails MCP backends by @msaad00 in #3582
• feat(reachability): Gradle-only Java symbol join via build.gradle coords by @msaad00 in #3584
• docs(roadmap): validated quick-wins queue for evidence and discovery by @msaad00 in #3583
• feat(ingest): wire SARIF into external scanner detect_and_parse path by @msaad00 in #3585
• feat(vex): ingest CSAF and CycloneDX VEX documents by @msaad00 in #3586
• feat(output): registry verified badge and evidence ingest docs by @msaad00 in #3587
• refactor(output): migrate json and html CVE tables to Finding stream by @msaad00 in #3588
• feat(alignment): VEX on Finding stream and API scan field parity by @msaad00 in #3589
• chore(release): prepare v0.93.0 by @msaad00 in #3590
• feat(gap): pre-tag slice — Finding topology, lock cards, close #3242 by @msaad00 in #3592

Full Changelog: v0.92.0...v0.93.0